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FIG 3 


NUMBER 


DETECTION ATTRIBUTE 
(SUSPICIOUS SIGNATURE) 


1 


{ Dst=192.168.1.1/32,Protocol=TCP,Port=80 } 


2 


{ Dst=192.168.1.2/32,Protocol=UDP } 


3 


{ Dst=192.168.1.1/24 } 


FIG.4 


NUMBER 


DETECTION ATTRIBUTE (NORMAL CONDITION) 


1 


{ Src= 172. 16. 10.0/24} 


2 


{ TOS=0x01 } 



FIG.5 



NUM- 
BER 


ILLEGAL TRAFFIC CONDITION 


1 


PACKETS HAVING TRANSMISSION BAND OF T1 Kbps OR MORE ARE 
CONTINUOUSLY TRANSMITTED FOR S1 SECOND OR MORE 


2 


ICMP/ECHO REPLY PACKETS HAVING TRANSMISSION BAND OF T2 Kbps OR 
MORE ARE CONTINUOUSLY TRANSMITTED FOR S2 SECONDS OR MORE 


1 


FRAGMENT PACKETS HAVING TRANSMISSION BAND OF T3 Kbps OR 
MORE ARE CONTINUOUSLY TRANSMITTED FOR S3 SECONDS OR MORE 
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FIG.8 
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FIG. 10 
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